Definition
A control is a safeguard or countermeasure implemented to manage risk. It is a measure that modifies risk by eliminating or reducing a threat, vulnerability, or unwanted outcome. Controls are put in place to ensure that objectives are met, systems operate as intended, and compliance requirements are satisfied. In practice, controls can be technical, administrative, or physical, and their effectiveness depends on proper design, implementation, and ongoing monitoring. Implementing appropriate controls is crucial for protecting assets, maintaining operational efficiency, and achieving business goals. For example, a firewall serves as a technical control to prevent unauthorized network access, while a password policy is an administrative control to enhance account security. Controls are distinct from policies, which define the rules, whereas controls are the actions taken to enforce those rules. You will encounter controls extensively in cybersecurity domains such as CompTIA Security+, CySA+, and PenTest+, as well as in project management certifications like PMP and CAPM.